The CPU considers a given va as executable if none of its levels have
the NOX bit. With the top level recursive slot, however, several levels
are recursively omitted, which implies that each entry that is not the
child of NOX-ed parents actually appears somewhere in the virtual space
as executable via this slot, even if it is followed by an underlying
entry that has the NOX bit.
This recursive slot is only used to edit the page tree itself. Make it
non-executable.